Using kubernetes cilium.io with k8s.nginx.org

Question

Pulumi · Accepted Answer

To set up a Kubernetes cluster with Cilium as the CNI (Container Network Interface) plugin, allowing for advanced networking capabilities, and Nginx as the Ingress controller to manage external access to your services, follow the steps below.

First, let's break down what we need:

1. A Kubernetes cluster: This cluster is the core set of resources where your workloads (containers) will run. For this example, we'll assume you have a Kubernetes cluster up and running.

2. Cilium: This is a CNI plugin for Kubernetes that provides advanced networking features such as network policies, load balancing, and observability. Cilium will be installed into your Kubernetes cluster.

3. Nginx Ingress Controller: This is an Ingress controller that uses Nginx to manage external access to HTTP services in a Kubernetes cluster. The Ingress controller will allow you to route traffic from outside your Kubernetes cluster to services within the cluster.

Here's how you might set up Cilium and Nginx Ingress in your cluster using Pulumi with TypeScript.

### Install Pulumi
Before you begin, you need to have Pulumi installed. If you haven't done so, you can install Pulumi from [here](https://www.pulumi.com/docs/get-started/install/).

### Program Setup
First, create a new directory for your Pulumi project and generate a new Pulumi project using `pulumi new kubernetes-typescript`.

```bash
mkdir pulumi-k8s-cilium-nginx
cd pulumi-k8s-cilium-nginx
pulumi new kubernetes-typescript
```

Follow the prompts by Pulumi; it will set up a new project with everything you would need.

### Writing Pulumi Code
Within the project directory, edit the `index.ts` to include the necessary resources. Below is a detailed explanation and the program for setting up Cilium and Nginx Ingress.

```typescript
import * as k8s from "@pulumi/kubernetes";

// We assume you already have a Kubernetes cluster configured and the context is set.
// The K8s provider uses the current context from your kubeconfig file.
const provider = new k8s.Provider("k8s-provider");

// Deploy Cilium for advanced networking features within your cluster
const cilium = new k8s.yaml.ConfigFile("cilium", {
    file: "https://raw.githubusercontent.com/cilium/cilium/v1.11/install/kubernetes/quick-install.yaml",
}, { provider: provider });

// Once Cilium is up and running, deploy the Nginx Ingress controller.
// The Ingress controller will manage external access to services within your cluster.
const nginxIngressController = new k8s.helm.v3.Release("nginx-ingress", {
    chart: "ingress-nginx",
    version: "3.36.0",
    repositoryOpts: {
        repo: "https://kubernetes.github.io/ingress-nginx",
    },
    namespace: "ingress-nginx",
    // Values override for the Nginx helm chart.
    values: {
        controller: {
            replicaCount: 2, // Optional: you can define how many replicas of Nginx you want.
            metrics: {
                enabled: true, // Expose Prometheus metrics.
            },
        },
    },
}, { provider: provider, dependsOn: cilium });

// Export the public IP of the Nginx Ingress to access services from the Internet
export const ingressIp = nginxIngressController.status.apply(status => status.loadBalancer.ingress[0].ip);
```

This program does the following:

- Imports the `@pulumi/kubernetes` package, which contains the necessary components to interface with Kubernetes.

- Defines a Pulumi Kubernetes provider that represents the configured Kubernetes cluster.

- Deploys Cilium using a YAML configuration file directly from the Cilium GitHub repository. Cilium's quick-install YAML is applied to the cluster, setting it up as the cluster's CNI plugin.

- After deploying Cilium, deploys the Nginx Ingress Controller via a Helm chart. This setup includes overriding default values to customize the deployment. In this case, metrics are enabled for Prometheus monitoring, and we specify the desired number of replica sets for redundancy and high availability.

- Finally, the program exports the public IP address of the Nginx Ingress LoadBalancer service so you can access your cluster's services externally.

Remember to replace the version number and configurations according to your specific requirements or the latest versions available at the time of deployment.

To apply this Pulumi program and create these resources in your Kubernetes cluster, run the following command in the terminal:

```bash
pulumi up
```

Upon successful deployment, Pulumi CLI will output the public IP address of your Nginx Ingress, which you can use to access your cluster services.

Please note that this is an infrastructure-as-code approach and will require appropriate permissions and context for interacting with your cloud and Kubernetes cluster. Ensure you authenticate with your cloud provider and have `kubectl` configured with the correct context.